Secrets
Keys, passwords and tokens across the whole Git history, not only in the current state.
Security review for GitHub organisations
Security and architecture review for your GitHub organisation, with ready-to-run fix commands.
A daily scan for secrets, dependencies and hygiene, a monthly architecture review. For software companies and agencies without their own security team, and for internal IT that builds its own software.
- Read-only access, only to the repositories you choose
- Source code is not stored
- First report within 24 hours
CriticalSecret in the history
contoso/shop-api · config/settings.py · commit 4f2a91c
An API key has been in the repository since the first commit. It is deleted in the current state but still readable in the history.
Fix command for Claude Code
claude "Rotate the key in config/settings.py, read it from the vault from now on and remove it from the history."- findings
- 23
- repositories
- 12
- coverage
- 97 %
How it works
Four steps from access to a ready fix.
- 01
Install
The GitHub App only reads, and only the repositories you choose.
- 02
First report
Within 24 hours: secrets across the whole history, vulnerable dependencies, repository hygiene and an AI review of changes.
- 03
Monthly review
An architecture review with measured coverage and a PDF report for management.
- 04
Fix
A ready-to-run Claude Code command for every finding, as a GitHub issue if you like.
Checks
What Code Guard checks in your repositories.
The basics every day, the architecture every month. Every finding names place, rule, description and recommendation.
Dependencies
Packages with known vulnerabilities, per repository and version.
Repository hygiene
Missing branch protection, public repositories, failing pipelines, stale pull requests.
AI review of changes
New commits are read for security and quality defects. Secrets are redacted first.
Architecture review
Once a month, with measured coverage in the report instead of an estimate.
Report and issues
A PDF for management, findings as GitHub issues in the affected repository if you like.
Privacy
Your code stays your code.
Read-only
The app only reads. It cannot change, create or delete anything.
No copy of the code
Source code is not stored. Findings are: place, rule, description, recommendation.
Redacted before the AI review
For the AI review, code is sent to Anthropic; secrets are redacted first.
Plans
A plan for every size of organisation.
Starter
- up to 3 repositories
- daily scan
- monthly review
Team
- per repository
- from 5 repositories
Business
- up to 25 repositories
- PDF for management
- issue export
Enterprise
- more than 25 repositories
- own model choice
- SSO
- on request
Prices net per month, shown at checkout.
Ready for your first report?
The app installs in a few minutes. The first report follows within 24 hours.